AMLA's New AML Standards: What the 'Principles-Based' Label Really Means for Your Firm

Alejandro Martínez · 2026-10-15

On October 1, 2026, the Anti-Money Laundering Authority (AMLA) finalized three regulatory technical standards under the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624). These standards tackle customer due diligence, the line between a business relationship and an occasional transaction, and group-wide arrangements. They apply to both financial and non-financial obliged entities, and AMLA insists they're principles-based, adding no new obligations beyond the AMLR itself. But don't let that reassurance fool you. The "principles-based" label is doing a lot of heavy lifting here, and it changes the game for compliance teams. ### Why 'Principles-Based' Is a Double-Edged Sword AMLA's statement that the standards are principles-based sounds like good news—less prescriptive, more flexible. But here's the catch: it shifts the burden of justification squarely onto each firm. Instead of ticking boxes to show you've followed a rule, you now need to demonstrate that your approach meets supervisory expectations. And those expectations aren't always written down. Think of it like this: a tick-box rule is a recipe. You follow the steps, and you're done. A principle is more like a goal—say, "make a delicious meal." You have to decide what that means, how to get there, and then defend your choices to a judge (the supervisor). That's a lot more work, and it requires judgment, not just compliance. ### What the Three Standards Cover Let's break down what these standards actually address: - **Customer due diligence (CDD):** How firms verify who their customers are and assess risk. The standard likely clarifies what "adequate" CDD looks like in practice. - **Business relationship vs. occasional transaction:** Where's the line? This matters because ongoing relationships trigger different obligations than one-off deals. - **Group-wide arrangements:** For firms operating across borders, how do you ensure consistent AML standards across all entities? Each of these areas is ripe for interpretation, and that's exactly the point. AMLA isn't telling you *how* to do it; it's telling you *what* to achieve. ### The Real Test: Supervisory Expectations Here's the thing: supervisory expectations are not static. They evolve as regulators see how firms apply the principles. So what passes muster today might not tomorrow. That means you can't just set your AML program and forget it—you need to keep testing, documenting, and refining. > "The principles-based approach means the burden of proof is on you. You have to show not just that you followed a process, but that your process actually works." This is where many firms stumble. They treat compliance as a checklist, and when the supervisor asks *why* they did something a certain way, they don't have a convincing answer. Under a principles-based regime, "because the rule said so" isn't good enough. ### What Should You Do Now? First, don't panic. The standards don't create new obligations—they clarify existing ones. But they do raise the bar for documentation and justification. Here are a few practical steps: - **Review your risk assessments:** Make sure they're not just generic templates. They should reflect your specific business and customer base. - **Document your decisions:** Whenever you make a judgment call—like deciding a transaction is occasional rather than a relationship—write down your reasoning. - **Train your team:** Everyone needs to understand that compliance isn't about following rules blindly; it's about achieving the outcomes the rules are meant to produce. - **Engage with supervisors:** If you're unsure how a principle applies to your business, ask. Better to clarify now than to explain later. ### The Bottom Line AMLA's new standards are a shift toward a more mature, risk-based approach to AML. They trust firms to use judgment—but they also expect firms to be able to defend that judgment. That's a higher bar, and it's one that requires a cultural shift, not just a policy update. So take the "principles-based" label seriously, but don't mistake it for "easy."